ThreeAM Ransomware Group Falsely Claims Australian Medical Council as Victim On 12 June, the ThreeAM ransomware group listed the Australian Medical Council (AMC) as one of a dozen victims on its darknet leak site. However, the AMC has denied being breached, stating that the data published by the hackers does not belong to the organization. An AMC spokesperson confirmed that the council does not hold patient data and has no role in delivering health services. The AMC has reported the incident to the Australian Cyber Security Centre (ACSC) for further investigation. While the leaked dataset includes documents such as business processes, blank forms, and correspondence featuring the letterhead of Aghapy Medical Centre in Victoria, no patient records appear to have been exposed. The Aghapy Medical Centre has declined to comment. ### Who is ThreeAM? ThreeAM is a Russian-speaking ransomware group first observed in September 2023, with suspected ties to LockBit and BlackSuit. The group employs double-extortion tactics, encrypting victims' data while threatening to leak stolen information unless a ransom is paid. Since its emergence, ThreeAM has claimed 85 victims, with its most recent confirmed Australian target being ANU Enterprise in November 2024. The group’s ransom note warns of encrypted files and vanished backups, promising to restore systems only upon payment. The incident highlights the growing trend of ransomware actors misrepresenting breaches or exaggerating the significance of stolen data.